---
title: "Update API key"
method: PATCH
path: "/apps/{app_id}/auth/tokens/{token_id}"
---

# Update API key

`PATCH /apps/{app_id}/auth/tokens/{token_id}`

Update a Rich Authentication Token (App API Key) for a OneSignal app. Modify the token's name or IP allowlist settings using your Organization API Key.

## Path parameters

- `app_id` string, required
- `token_id` string, required

## Headers

- `Content-Type` string, required
- `Authorization` string, required

## Request body

- object
  - `name` string — An internal name you set to help organize and track API keys (Rich Authentication Tokens). Maximum 128 characters.
  - `ip_allowlist_mode` 'disabled' | 'explicit' — Defaults to `disabled`, can be set to `explicit`. If set to `explicit`, a list of network addresses in the form of CIDRs has to be specified in the `ip_allowlist` parameter.
  - `ip_allowlist` string[] — An array of allowed networks in CIDRs notation. Only IPs in those ranges will be permitted to use the API key.

## Response `200`

Returns an empty object on success. Issue a follow-up GET to read the updated values.

- object

## Other responses

- `400` — 400
- `403` — Forbidden. Your organization permissions do not allow this action.
- `404` — Token not found in this app, or the App ID was wrong.
- `429` — Rate limit exceeded. Wait the number of seconds in the `Retry-After` header before retrying.
- `503` — Service temporarily unavailable. Retry after a short backoff. The body may be empty or non-JSON in some failure modes.

---

[API](https://skmtc.net/onesignal/apis/api-onesignal-com.md) · [All operations](https://skmtc.net/onesignal/apis/api-onesignal-com/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onesignal/api-onesignal-com/versions/0fc223f7e338/schema)